Russian hacker exploits Google Gemini CLI as hacking agent to run eight-device botnet

Google Gemini CLI abused as a hacking agent, malware botnet operator

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. The AI agent responded to the attacker's prompts, troubleshooting problems on the fly and even proposing operational improvements at least 59 times. In more than 200 sessions between May 19 and April 21, the threat actor worked with the AI tool to deploy and operate an infrastructure that controlled eight systems in a dental clinic and to get access to the OpenDental database. The AI agent assumed the role of an "authorized pen tester" acting without safety disclaimers and automatically saved any credentials. Its skill file contained the command-and-control (C2) playbook, complete with a description of the architecture, standard operations, infection code, commands for persistence, and troubleshooting steps. AI controlling the botnet Trend Micro researchers say that the threat actor used Gemini CLI to migrate the botnet to a new C2 infrastructure. Starting from a single instruction that read ""Study the C2 migration," the AI processed the guide and prepared all the steps and code necessary for the process. The AI migrated the C2 infrastructure, handling the architecture, coding, VPS deployment, Cloudflare configuration, and initial debugging in just six minutes. "The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel," Trend Micro says. When machines initially failed to reconnect, the AI diagnosed conflicting traffic between the old and new servers, and after the actor shut down the old server, all bots reconnected. Daily operation logs show that the threat actor continued to manage the botnet entirely through natural-language requests, asking which machines were online, listing files on particular computers, and generating infection links. From a technical standpoint, the botnet setup was remarkably lightweight, containing all components and instructions in three plain-text files totaling roughly 5 KB. These contained a Gemini jailbreak prompt, a C2 playbook covering infection, persistence, and troubleshooting, and a migration guide for rebuilding the infrastructure. The C2 used an in-memory Python HTTP server and PowerShell agents that polled it every five seconds, and persistence relied on scheduled tasks, WMI events, and registry modifications, depending on privileges. The malware itself was rather unsophisticated, according to Trend Micro, as it did not benefit from obfuscation, packing, or evasion mechanisms. Beyond the botnet, the actor allegedly used AI for password guessing, generating plausible variants of existing passwords for WordPress portals, and analyzing 1Password dumps to find exploitation alleys. The researchers say that the latter failed only due to the operation extending for long enough that the AI lost track of the broader attack concept. The retrieved logs show that Gemini refused to comply in at least one case, when it was asked to build a self-spreading "agent-bomb," but this simply made the threat actor try out other tasks instead. BleepingComputer has contacted Google for a comment on this example of Gemini CLI abuse, but we have not received a response as of publishing.

Russian hacker turns Gemini CLI into a hacking agent, creates small-scale botnet

* Russian hacker "bandcampro" used Google's Gemini CLI to control an eight‑device botnet at a dental clinic * The attacker tricked the AI by posing as a pen tester, directing it to migrate C2 infrastructure, troubleshoot connectivity, and prepare payload bundles * The AI assisted with daily operations like password guessing and WordPress access, highlighting risks of misuse when threat actors co‑opt AI tools A Russian hacker and his AI companion were able to successfully control a miniature, eight-system botnet, with the hacker giving instructions in conversational language, and the AI doing his bidding, experts have found. Analyzing 200 session logs obtained from the Russian-speaking threat actor known as "bandcampro", cybersecurity researchers Trend Micro saw the hacker use Google's Gemini CLI, an open source AI command-line tool that lets developers interact with Google's Gemini AI models directly from a terminal. Scouring through a month's worth of session logs (between April 21 and May 19 2026), the researchers discovered that the attacker tricked the AI by telling it they were an "authorized pen tester". While the AI mostly complied with their nefarious overlord, they refused the orders on at least one occasion. Gone in six minutes Trend Micro found the hacker controlled eight devices belonging to a dental clinic and sought to access their access their OpenDental database. Using the AI, bandcampro did a number of things, starting with migrating the botnet to a new C2 infrastructure. He gave the AI a skill file with the full architecture description, standard operating procedures, infection one-liner, persistence commands, and troubleshooting steps. He then told it to "study the C2 migration", which had the AI process the guide and prepare all the code and necessary steps. It took the tool around six minutes to get the job done. "The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel," Trend Micro says. Bandcampro then used the AI to troubleshoot connectivity issues, as well as for various daily operations, such as guessing passwords, generating plausible variants of existing passwords for WordPress portals, and more. Via BleepingComputer Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.